Your Aadhaar, their SIM: How scammers hijacked identities

Raipur: If you’ve ever bought a SIM card, police say there’s a scam you probably never imagined.Investigating fake Kaun Banega Crorepati (KBC) prize scams and online sextortion, Raipur range cyber police have arrested two authorised SIM retailers who allegedly activated extra SIM cards using customers’ Aadhaar verification and biometric authentication, then sold those numbers to cybercriminals.The accused — Umesh Prajapati (23), who ran Prajapati Telecom in Chhatarpur, and Manoj Devangan (29), owner of Manoj Mobile in Mudhipar, Khairagarh — were arrested under ‘operation cyber shield’ and remanded in judicial custody.According to range IG Amresh Mishra, the racket came to light while investigators were probing two cybercrime cases — a fake KBC prize scam and a sextortion case in which a man from Gariyaband district lost Rs 7.9 lakh after fraudsters befriended him on social media, lured him into a WhatsApp video call, morphed the footage into an obscene clip and threatened to upload it on YouTube unless he paid money.The second case involved fraudsters posing as representatives of Kaun Banega Crorepati, who allegedly convinced a victim that he had won a prize and demanded payment of “tax” before the money could be released.How the racket workedPolice said the accused exploited the mandatory SIM verification process.Whenever customers visited their shops to buy a new SIM card or port an existing mobile number, they completed the telecom companies’ Aadhaar-based KYC formalities.

This is when the retailers allegedly manipulated the process.If the customer underwent electronic KYC, the accused allegedly asked them to place their thumb on the biometric scanner more than once or repeat eye-blink verification, claiming it was part of the authentication process. Police said those repeated biometric verifications were used to activate an additional SIM card, even though the customer had requested only one.In cases where customers submitted a physical copy of their Aadhaar card, the retailers completed the digital KYC process themselves and issued another SIM in the customer’s name without informing them.The unsuspecting customer left the shop with the SIM they had purchased. The secretly activated second SIM, however, remained with the retailers.Police alleged these additional SIM cards were then sold at a premium to cybercriminals operating in different states.

Since the SIMs were registered in the names of genuine subscribers, they were used for fake KBC prize calls, WhatsApp accounts, sextortion, online financial fraud and other cyber offences.How investigators tracked themPolice said investigators first obtained details of the mobile numbers and social media accounts used in the two cybercrime cases from telecom service providers.The investigation then moved beyond the fraudsters themselves to identify where the SIM cards had originally been issued.Technical analysis of subscriber records, telecom activation logs, statements of victims and witnesses, and the questioning of suspects eventually led investigators to the two authorised Point of Sale (POS) agents.During interrogation, police said, both accused admitted to activating additional SIM cards through misuse of the KYC process and selling them to cybercriminals.Investigators are now trying to identify the cybercriminals who bought the illegally activated SIM cards and determine whether more unauthorised connections were issued through the same modus operandi.